dsh-autorestart 0.8.3 → 0.8.5

package/lib/backup.js

@@ -31,8 +31,176 @@ export const PLUGINS_DIR = 'node_modules';
 /** The manifest written into every backup. */
 export const MANIFEST_NAME = 'manifest.json';
 
-/** How many backups are kept by default. */
-export const DEFAULT_MAX_BACKUPS = 2;
+/**
+ * How many backups are kept by default.
+ *
+ * THREE (user decision, 2026-10-30: "the current one plus the two before it"),
+ * so a rollback can step one restart further back than the newest copy. The
+ * newest KNOWN-GOOD backup is never pruned whatever this number says — losing
+ * it would leave the machine with nothing to roll back to.
+ */
+export const DEFAULT_MAX_BACKUPS = 3;
+
+/**
+ * THE IDENTITY OF A BACKUP (user decision, 2026-10-30).
+ *
+ * A pre-restart snapshot is taken BEFORE the restart: it holds exactly the state
+ * that is about to be tested, i.e. possibly the state that breaks the boot. So a
+ * restore may only ever use a backup that HAS BOOTED: the known-good one.
+ *
+ * Two identities:
+ *   'snapshot'    taken before a restart, not proven yet;
+ *   'known-good'  a restart with this content really came up — or the seed taken
+ *                 on first install (nothing to prove yet, nothing to lose either).
+ *
+ * A directory without a readable meta.json is 'unknown': it was written before
+ * this rule existed and is NEVER used for an automatic rollback.
+ */
+export const META_NAME = 'meta.json';
+export const KIND_SNAPSHOT = 'snapshot';
+export const KIND_KNOWN_GOOD = 'known-good';
+export const KIND_UNKNOWN = 'unknown';
+
+/**
+ * Coerce anything into one of the three identities.
+ *
+ * @param {unknown} raw
+ * @returns {string}
+ */
+function normalizeKind(raw) {
+  if (raw === KIND_KNOWN_GOOD) return KIND_KNOWN_GOOD;
+  if (raw === KIND_SNAPSHOT) return KIND_SNAPSHOT;
+  return KIND_UNKNOWN;
+}
+
+/**
+ * Read the identity of one backup directory.
+ *
+ * A missing or unreadable meta.json is NOT an error: it means the backup was
+ * written before the identity layer existed, and the answer is `'unknown'`.
+ *
+ * @param {string} backupDir
+ * @returns {{ kind: string, at: number|null, version: string|null, bootId: string|null, requestId: number|null, reason: string|null, upgradedAt: number|null }}
+ */
+export function readBackupMeta(backupDir) {
+  const empty = {
+    kind: KIND_UNKNOWN,
+    at: null,
+    version: null,
+    bootId: null,
+    requestId: null,
+    reason: null,
+    upgradedAt: null,
+  };
+  let parsed = null;
+  try {
+    parsed = JSON.parse(fs.readFileSync(path.join(String(backupDir ?? ''), META_NAME), 'utf8'));
+  } catch {
+    return empty;
+  }
+  if (!parsed || typeof parsed !== 'object') return empty;
+  return {
+    kind: normalizeKind(parsed.kind),
+    at: Number.isFinite(parsed.at) ? parsed.at : null,
+    version: typeof parsed.version === 'string' && parsed.version !== '' ? parsed.version : null,
+    bootId: typeof parsed.bootId === 'string' && parsed.bootId !== '' ? parsed.bootId : null,
+    requestId: Number.isFinite(parsed.requestId) ? parsed.requestId : null,
+    reason: typeof parsed.reason === 'string' && parsed.reason !== '' ? parsed.reason : null,
+    upgradedAt: Number.isFinite(parsed.upgradedAt) ? parsed.upgradedAt : null,
+  };
+}
+
+/**
+ * Write the identity of one backup directory.
+ *
+ * Best effort: a backup whose meta cannot be written stays a usable `'unknown'`
+ * one (it is never used for an AUTOMATIC rollback, but it is still on disk).
+ *
+ * @param {string} backupDir
+ * @param {object} [meta]
+ * @returns {boolean} whether it was written
+ */
+export function writeBackupMeta(backupDir, meta = {}) {
+  const record = {
+    kind: normalizeKind(meta.kind),
+    at: Number.isFinite(meta.at) ? meta.at : Date.now(),
+    version: typeof meta.version === 'string' && meta.version !== '' ? meta.version : null,
+    bootId: typeof meta.bootId === 'string' && meta.bootId !== '' ? meta.bootId : null,
+    requestId: Number.isFinite(meta.requestId) ? meta.requestId : null,
+    reason: typeof meta.reason === 'string' && meta.reason !== '' ? meta.reason : null,
+    upgradedAt: Number.isFinite(meta.upgradedAt) ? meta.upgradedAt : null,
+  };
+  try {
+    fs.writeFileSync(path.join(String(backupDir ?? ''), META_NAME), JSON.stringify(record, null, 2), 'utf8');
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * PROMOTE a snapshot to known-good — the restart that used it really came up.
+ *
+ * The CONTENT does not change: "it booted" IS the proof, and it is written where
+ * the next rollback looks for it.
+ *
+ * @param {string} backupDir
+ * @param {{ reason?: string, version?: string|null, bootId?: string|null, now?: number }} [options]
+ * @returns {boolean}
+ */
+export function markKnownGood(backupDir, { reason = 'boot-ok', version = null, bootId = null, now = Date.now() } = {}) {
+  const current = readBackupMeta(backupDir);
+  const manifest = readManifest(backupDir);
+  // Nothing to promote: neither an identity nor a manifest to stand on.
+  if (manifest === null && current.kind === KIND_UNKNOWN) return false;
+  return writeBackupMeta(backupDir, {
+    kind: KIND_KNOWN_GOOD,
+    at: current.at !== null ? current.at : (manifest && Number.isFinite(manifest.at) ? manifest.at : now),
+    version: version !== null && version !== undefined ? version : current.version,
+    bootId: bootId !== null && bootId !== undefined ? bootId : current.bootId,
+    requestId: current.requestId,
+    reason: current.kind === KIND_KNOWN_GOOD ? (current.reason || reason) : reason,
+    upgradedAt: now,
+  });
+}
+
+/**
+ * THE NEWEST BACKUP THAT HAS PROVEN IT CAN BOOT — the only valid target of an
+ * automatic rollback.
+ *
+ * Backups without a meta.json (`'unknown'`) are skipped on purpose: they were
+ * written before the identity layer and were never proven.
+ *
+ * @param {string} backupsDir the backups ROOT (the directory holding the copies)
+ * @returns {object|null}
+ */
+export function latestKnownGood(backupsDir) {
+  for (const entry of listBackupIdentities(backupsDir)) {
+    if (entry.kind === KIND_KNOWN_GOOD) return entry;
+  }
+  return null;
+}
+
+/**
+ * Every backup with its identity, newest first (what the settings page and the
+ * health route show: identity, time, size, version).
+ *
+ * @param {string} backupsDir the backups ROOT
+ * @returns {Array<object>}
+ */
+export function listBackupIdentities(backupsDir) {
+  return listBackups(backupsDir).map((backup) => {
+    const meta = readBackupMeta(backup.dir);
+    return {
+      ...backup,
+      kind: meta.kind,
+      version: meta.version,
+      reason: meta.reason,
+      requestId: meta.requestId,
+      upgradedAt: meta.upgradedAt,
+    };
+  });
+}
 
 /** The report the detached helper writes when it rolls a backup back. */
 export const ROLLBACK_REPORT_NAME = 'last-rollback.json';
@@ -365,6 +533,10 @@ export function removeBackupDir(dir) {
 /**
  * Keep only the newest `maxBackups` backup directories.
  *
+ * THE NEWEST KNOWN-GOOD BACKUP IS NEVER REMOVED (user decision, 2026-10-30): it
+ * is the only copy a failed boot may be rolled back to, so the "oldest first"
+ * order steps around it — even when it is the very last one left.
+ *
  * @param {string} backupsDir
  * @param {number} [maxBackups]
  * @returns {string[]} the names that were removed
@@ -382,8 +554,24 @@ export function pruneBackups(backupsDir, maxBackups = DEFAULT_MAX_BACKUPS) {
   } catch {
     return [];
   }
+  // THE NEWEST KNOWN-GOOD IS NEVER REMOVED: it is the only thing a failed boot
+  // can roll back to, so "the oldest first" has to step around it.
+  const protectedName = (() => {
+    for (const name of names.slice().reverse()) {
+      const meta = readBackupMeta(path.join(backupsDir, name));
+      if (meta.kind === KIND_KNOWN_GOOD) return name;
+    }
+    return null;
+  })();
+  const victims = [];
+  const budget = Math.max(0, names.length - limit);
+  for (const name of names) {
+    if (victims.length >= budget) break;
+    if (name === protectedName) continue;
+    victims.push(name);
+  }
   const removed = [];
-  for (const name of names.slice(0, Math.max(0, names.length - limit))) {
+  for (const name of victims) {
     const target = path.join(backupsDir, name);
     try {
       fs.rmSync(target, { recursive: true, force: true });
@@ -473,11 +661,16 @@ export function readManifest(backupDir) {
  *   includePlugins?: boolean,
  *   maxBackups?: number,
  *   now?: number,
+ *   kind?: string,
+ *   reason?: string|null,
+ *   version?: string|null,
+ *   bootId?: string|null,
+ *   requestId?: number|null,
  *   onProgress?: ((progress: { files: number, bytes: number, total: number, filesTotal: number }) => void)|null,
  *   shouldCancel?: (() => boolean)|null,
  *   measure?: ((profileDir: string, includePlugins: boolean) => { files: number, bytes: number })|null,
  * }} options
- * @returns {{ ok: boolean, cancelled: boolean, dir: string|null, stamp: string|null, at: number|null, atLocal: string|null, durationMs: number, bytes: number, totalBytes: number, fileCount: number, files: string[], includePlugins: boolean, pruned: string[], error: string|null }}
+ * @returns {{ ok: boolean, cancelled: boolean, dir: string|null, stamp: string|null, at: number|null, atLocal: string|null, kind: string, durationMs: number, bytes: number, totalBytes: number, fileCount: number, files: string[], includePlugins: boolean, pruned: string[], error: string|null }}
  */
 export async function createBackup({
   profileDir,
@@ -485,12 +678,20 @@ export async function createBackup({
   includePlugins = true,
   maxBackups = DEFAULT_MAX_BACKUPS,
   now = Date.now(),
+  kind = KIND_SNAPSHOT,
+  reason = null,
+  version = null,
+  bootId = null,
+  requestId = null,
   onProgress = null,
   shouldCancel = null,
   measure = null,
 } = {}) {
   const profile = typeof profileDir === 'string' ? profileDir.trim() : '';
   const root = typeof backupsDir === 'string' ? backupsDir.trim() : '';
+  // A snapshot taken before a restart is NOT proven yet; only an explicit
+  // 'known-good' (the first-install seed) starts out proven.
+  const metaKind = kind === KIND_KNOWN_GOOD || kind === KIND_UNKNOWN ? kind : KIND_SNAPSHOT;
   const startedAt = Date.now();
   const base = {
     ok: false,
@@ -499,6 +700,7 @@ export async function createBackup({
     stamp: null,
     at: null,
     atLocal: null,
+    kind: metaKind,
     durationMs: 0,
     bytes: 0,
     totalBytes: 0,
@@ -656,6 +858,18 @@ export async function createBackup({
     return { ...base, stamp, files, bytes, totalBytes: measured.bytes, fileCount, error: 'could not write the backup manifest: ' + (error && error.message ? error.message : String(error)) };
   }
 
+  // THE IDENTITY, right next to the manifest: what this copy is and where it
+  // came from. Best effort — a copy whose meta cannot be written stays an
+  // 'unknown' one on disk (never used for an automatic rollback).
+  writeBackupMeta(dir, {
+    kind: metaKind,
+    at: Number(now),
+    version,
+    bootId,
+    requestId,
+    reason,
+  });
+
   const pruned = pruneBackups(root, maxBackups);
   return {
     ...base,
@@ -664,6 +878,7 @@ export async function createBackup({
     stamp,
     at: Number(now),
     atLocal: manifest.atLocal,
+    kind: metaKind,
     durationMs: Math.max(0, Date.now() - startedAt),
     bytes,
     totalBytes: measured.bytes,

package/lib/checkpoint.js

@@ -59,6 +59,12 @@ const RESTART_KEYS = new Set([
   'notBefore',
   'requesters',
   'parkGoals',
+  // THE SNAPSHOT THIS REQUEST ALREADY TOOK. It lives on the request, so it is
+  // dropped by itself when the request is withdrawn or carried out (the request
+  // object is replaced / removed), and it survives a deferral — which is the whole
+  // point: a 205 MB copy must not be repeated because a conversation interrupted
+  // the restart (user report, 2026-10-30).
+  'snapshot',
 ]);
 
 const ENTRY_KEYS = new Set([
@@ -110,6 +116,9 @@ const TOP_LEVEL_KEYS = new Set([
   'seenFeatureVersions',
   'onboarding',
   'sleep',
+  // The seed of the FIRST safe copy: what happened when a new host process
+  // looked for a known-good backup and found none (user decision, 2026-10-30).
+  'firstInstallBackup',
   'updatedAt',
 ]);
 
@@ -228,6 +237,10 @@ function normalizeRestartPhase(raw, now) {
     // that polls every 2 s would otherwise never learn that a backup happened
     // (user report, 2026-10-29). null = nothing was measured.
     snapshotBytes: isFiniteNumber(raw.snapshotBytes) ? Math.max(0, Math.trunc(raw.snapshotBytes)) : null,
+    // WHY the stage is what it is ("deferred: conversation-active", "snapshot
+    // done", …). A stage without a reason cannot be diagnosed after the fact —
+    // and the hang this fixes was exactly an unexplained leftover stage.
+    reason: typeof raw.reason === 'string' && raw.reason !== '' ? raw.reason : null,
     blocked: isFiniteNumber(raw.blocked) ? Math.max(0, Math.trunc(raw.blocked)) : 0,
   };
   return { record, changed };
@@ -244,7 +257,16 @@ function normalizeRestartPhase(raw, now) {
  * @param {{ phase: string, now?: number, blocked?: number, restartStage?: boolean }} options
  * @returns {object|null} the recorded stage
  */
-export function setRestartPhase(state, { phase, now = Date.now(), blocked = 0, restartStage = true } = {}) {
+export function setRestartPhase(state, {
+  phase,
+  now = Date.now(),
+  blocked = 0,
+  restartStage = true,
+  reason = null,
+  // undefined = carry what the record already measured, null = forget it, a
+  // number = this is the size of the snapshot this restart already paid for.
+  snapshotBytes,
+} = {}) {
   if (!isObject(state)) return null;
   if (!RESTART_PHASES.includes(phase)) return state.restartPhase ?? null;
   const moment = isFiniteNumber(now) ? now : Date.now();
@@ -273,8 +295,14 @@ export function setRestartPhase(state, { phase, now = Date.now(), blocked = 0, r
       ? previous.progress
       : null,
     // A NEW restart starts with nothing measured; a stage change inside one
-    // restart keeps the size it already has.
-    snapshotBytes: sameRestart ? measuredBytes : null,
+    // restart keeps the size it already has — and a caller that knows the size
+    // (the request's own snapshot) may state it explicitly.
+    snapshotBytes: snapshotBytes === null
+      ? null
+      : (isFiniteNumber(snapshotBytes) ? Math.max(0, Math.trunc(snapshotBytes)) : (sameRestart ? measuredBytes : null)),
+    // WHY this stage (see normalizeRestartPhase): "deferred: <reason>" is what
+    // tells a reader that the restart went back to waiting on purpose.
+    reason: typeof reason === 'string' && reason !== '' ? reason : null,
     blocked: isFiniteNumber(blocked) ? Math.max(0, Math.trunc(blocked)) : 0,
   };
   state.restartPhase = record;
@@ -308,6 +336,7 @@ export function setRestartProgress(state, { files = 0, bytes = 0, total = 0, fil
     // The live byte counter IS the size of the snapshot so far: keeping it here
     // means the number survives the moment the copy ends.
     snapshotBytes: number(bytes),
+    reason: previous !== null && typeof previous.reason === 'string' ? previous.reason : null,
     blocked: previous !== null && isFiniteNumber(previous.blocked) ? previous.blocked : 0,
   };
   state.updatedAt = moment;
@@ -715,6 +744,31 @@ function normalizeRequesters(raw) {
  * @param {unknown} raw
  * @returns {{ restart: object|null, changed: boolean }}
  */
+/**
+ * Coerce the "this request already took a snapshot" record.
+ *
+ * It is a pointer plus the numbers of that copy, and nothing else: the profile
+ * itself lives in the backup directory, which is checked against the manifest
+ * before it is used again.
+ *
+ * @param {unknown} raw
+ * @returns {{ requestedAt: number, dir: string, profileDir: string|null, files: number, bytes: number, total: number, at: number }|null}
+ */
+function normalizeRestartSnapshot(raw) {
+  if (!isObject(raw)) return null;
+  if (typeof raw.dir !== 'string' || raw.dir === '') return null;
+  const number = (value) => (isFiniteNumber(value) ? Math.max(0, Math.trunc(value)) : 0);
+  return {
+    requestedAt: number(raw.requestedAt),
+    dir: raw.dir,
+    profileDir: typeof raw.profileDir === 'string' && raw.profileDir !== '' ? raw.profileDir : null,
+    files: number(raw.files),
+    bytes: number(raw.bytes),
+    total: number(raw.total),
+    at: number(raw.at),
+  };
+}
+
 function normalizeRestart(raw) {
   if (!isObject(raw)) return { restart: null, changed: raw !== null && raw !== undefined };
   let changed = false;
@@ -736,6 +790,11 @@ function normalizeRestart(raw) {
     // never deadlock behind a goal that keeps its own agent busy.
     parkGoals: raw.parkGoals !== false,
   };
+  // The snapshot is only carried when there IS one: a checkpoint that never took
+  // a snapshot must normalize to exactly the object it was.
+  const snapshot = normalizeRestartSnapshot(raw.snapshot);
+  if (snapshot !== null) restart.snapshot = snapshot;
+  else if (raw.snapshot != null) changed = true;
   if (!isFiniteNumber(raw.generation) || raw.generation < 0) changed = true;
   if (!isFiniteNumber(raw.requestedAt)) changed = true;
   if (!isFiniteNumber(raw.attempt) || raw.attempt < 0) changed = true;
@@ -845,9 +904,40 @@ export function normalizeState(raw, now = Date.now()) {
     if (onboarding.changed) repaired = true;
   }
 
+  // THE FIRST SAFE COPY: what happened when this machine looked for a
+  // known-good backup and found none. It survives a restart, so a machine with
+  // NO safe copy can say so instead of looking healthy.
+  if (raw.firstInstallBackup != null) {
+    const seeded = normalizeFirstInstallBackup(raw.firstInstallBackup);
+    if (seeded === null) repaired = true;
+    else state.firstInstallBackup = seeded;
+  }
+
   return { state, repaired };
 }
 
+/**
+ * Normalize the record of the first-install safe copy.
+ *
+ * A record without a `result` says nothing, so it is dropped (and the caller
+ * marks the state as repaired).
+ *
+ * @param {unknown} raw
+ * @returns {{ result: string, at: number|null, dir: string|null, bytes: number|null, error: string|null }|null}
+ */
+function normalizeFirstInstallBackup(raw) {
+  if (!isObject(raw)) return null;
+  const result = typeof raw.result === 'string' && raw.result !== '' ? raw.result : null;
+  if (result === null) return null;
+  return {
+    result,
+    at: isFiniteNumber(raw.at) ? raw.at : null,
+    dir: typeof raw.dir === 'string' && raw.dir !== '' ? raw.dir : null,
+    bytes: isFiniteNumber(raw.bytes) ? raw.bytes : null,
+    error: typeof raw.error === 'string' && raw.error !== '' ? raw.error : null,
+  };
+}
+
 /**
  * Read a checkpoint from disk. Never throws and never creates directories.
  *

package/lib/restart-phase.js

@@ -163,6 +163,7 @@ export function describeRestartPhase({
   progress = null,
   blocking = null,
   snapshotBytes = null,
+  reason = null,
   now = Date.now(),
 } = {}) {
   const stage = isRestartPhase(phase) ? phase : 'idle';
@@ -299,6 +300,10 @@ export function describeRestartPhase({
     snapshotBytes: snapshotBytes === null || snapshotBytes === undefined || snapshotBytes === ''
       ? null
       : nonNegative(snapshotBytes),
+    // WHY the stage is what it is: "deferred: conversation-active" says the
+    // restart went back to waiting, which is what a reader needs to tell a
+    // postponed restart from a running one.
+    reason: typeof reason === 'string' && reason !== '' ? reason : null,
     text,
   };
 }

package/locale/en.json

@@ -204,7 +204,24 @@
       "time": "Backup time",
       "size": "Backup size",
       "withPlugins": "(plugins included)",
-      "withoutPlugins": "(plugins excluded)"
+      "withoutPlugins": "(plugins excluded)",
+      "kindLabel": "Identity",
+      "kind": {
+        "known-good": "Known good",
+        "snapshot": "This restart's snapshot",
+        "unknown": "Old backup (unverified)"
+      },
+      "version": "version {v}",
+      "identityHint": "A backup has one of two identities: ① “known good” — the copy a boot has proven; when something breaks, only a known-good copy is rolled back, and the first install creates one automatically. ② “this restart's snapshot” — taken right before every restart and not proven yet; old backups (unverified) and that snapshot are never rolled back automatically. At most {n} copies are kept together (the oldest goes first; a known-good copy is never deleted). A manual rollback asks for confirmation first, then restarts automatically.",
+      "rollback": "Roll back to this copy",
+      "rollbackConfirmTitle": "Roll back to this copy?",
+      "rollbackConfirmBody": "The backup from {time} will be restored over the current state — **what you have now is replaced** (a snapshot of it is taken first, so this rollback can be undone).",
+      "rollbackConfirmRestart": "A restart follows automatically; this page disconnects during it and works again afterwards.",
+      "rollbackConfirmYes": "Roll back",
+      "rollbackConfirmNo": "Cancel",
+      "rollbackBusy": "Rolling back…",
+      "rollbackDone": "Rolled back — restarting…",
+      "rollbackFailed": "The rollback did not work: {message}"
     },
     "backupPlugins": {
       "label": "Include the installed plugins in the backup",
@@ -339,6 +356,9 @@
       "size": "{done} / {total}",
       "sizeDone": "{done}",
       "restarting": "Restarting…",
+      "deferred": "A conversation just started — restart postponed",
+      "deferredNote": "It will retry automatically when idle · {count} waiting",
+      "deferredNoteZero": "It will retry automatically when idle",
       "back": "Back again"
     }
   },

package/locale/zh.json

@@ -204,7 +204,24 @@
       "time": "备份时间",
       "size": "备份大小",
       "withPlugins": "（含已装插件）",
-      "withoutPlugins": "（不含已装插件）"
+      "withoutPlugins": "（不含已装插件）",
+      "kindLabel": "身份",
+      "kind": {
+        "known-good": "安全份",
+        "snapshot": "本次快照",
+        "unknown": "旧备份（未验证）"
+      },
+      "version": "版本 {v}",
+      "identityHint": "备份有两种身份：①「安全份」——启动成功后验证过的那一份，出问题只会回滚安全份；第一次安装时会自动生成一份。②「本次快照」——每次重启前刚拍的，还没验证过；旧备份（未验证）和它都不会被自动回滚。两类合计最多保留 {n} 份，超出删最旧的那份（安全份不会被删）。手动回退会先二次确认，然后会自动重启。",
+      "rollback": "回退到这一份",
+      "rollbackConfirmTitle": "确定回退到这一份？",
+      "rollbackConfirmBody": "会把 {time} 的那份备份还原到现在——**当前状态会被它覆盖**（覆盖前会先自动存一份当前快照，所以这次回退还能再退回来）。",
+      "rollbackConfirmRestart": "还原完成后会自动重启一次；重启期间这个页面会断开，回来后接着用。",
+      "rollbackConfirmYes": "确认回退",
+      "rollbackConfirmNo": "取消",
+      "rollbackBusy": "正在回退…",
+      "rollbackDone": "已回退，正在重启…",
+      "rollbackFailed": "回退没成功：{message}"
     },
     "backupPlugins": {
       "label": "备份包含已安装插件",
@@ -339,6 +356,9 @@
       "size": "{done} / {total}",
       "sizeDone": "{done}",
       "restarting": "正在重启…",
+      "deferred": "有新会话在跑，重启已暂缓",
+      "deferredNote": "等它结束会自动继续 · 已等 {count} 个会话",
+      "deferredNoteZero": "等它结束会自动继续",
       "back": "已回来"
     }
   },

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "dsh-autorestart",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "type": "module",
-  "description": "DeepSeek Harness plugin: restart without losing work. Waits until every conversation is idle, restarts the host, then automatically resumes the interrupted sessions. AI-generated, not human-reviewed: use with caution.",
+  "description": "DeepSeek Harness plugin: idle-aware restart with session resume, a snapshot before every restart that is restored automatically if the host fails to come back, and a countdown shutdown; works on the Windows desktop client and on hosted dsh web (Windows, WSL, Linux). AI-generated, not human-reviewed: use with caution.",
   "license": "MIT",
   "keywords": [
     "dsh",